6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735

General

Target

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
Size

195KB
MD5

3c39e034ff26d403cdfccacea38acbf5
SHA1

f45d2de958018c07688871efcc14ac37d25ebd46
SHA256

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735
SHA512

56dcd478f0e85ea78e3e5c0d04738866e1211c228692192c6abafea3f079ea8da6059b097c8f6f3608ebe0a990a917f5e381d0c9b1c422722a29b5b598a86ef3
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCo:+nymCAIuZAIuYSMjoqtMHfhf4Y

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4832) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/2332-1770-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2332-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/2332-1770-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk-1.8\jre\LICENSE.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN044.XML.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe

C:\Users\Admin\AppData\Local\Temp\6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
"C:\Users\Admin\AppData\Local\Temp\6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe"
1⤵
- Drops file in Program Files directory
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
195KB

MD5
e99a8e288398c7d5a19d2c2d951567b4

SHA1
241c5f89ff6a192557ebcfbd8a7878a76487c33d

SHA256
76fa7d367cc9f6300f9eec40eae69b67807776cb79ba661d16a068af42120b39

SHA512
059c049c6d1dc26a57bc68f5d7dfa960c3e1a48be51bc6fc1befb51c07f794012c1adab9981ab116c8a621930636e3ed20dc02ff50a0e71e72dba7a91d6a8fb4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
294KB

MD5
5b90531fe8ed24cd4e63f515533dc2cf

SHA1
f176aaa442d076ab07bd02a4a69650f94c4ded43

SHA256
ba0f1ea46274094ee7b7b60f3ebb96cfd06acb72121a21b6200e79862a555bb4

SHA512
a4ff31f146a459d53d6c5d31289c6750cfec764f037a9346bb5f1f06599c8494200cba4e9dd04c471ebfd5b890ff4d46fad50ca69436a39e6142033bfef4c869

Download Submit
memory/2332-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2332-1770-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads